Privacy notice for applicants

A. Controller
ib vogt GmbH
Helmholtzstr. 2-9
10587 Berlin
Germany

B. Data Protection Contact
datenschutz(at)ibvogt.com
Telefon: +49 30 3974400

C. What data is processed?
The following categories of data are processed in particular:

  • Identification and contact details (e.g., name, email address, telephone number, address)
  • Application documents and content (e.g., CV/resume, qualifications, certificates, cover letter, interview notes, communications)
  • Organisational and process data (e.g., status in the recruitment process, feedback, decision memos)
  • Technical usage and log data in connection with the application portal (e.g., IP address, user ID, login timestamps, logging data)
  • Where required: documents to verify the right to work (e.g., residence permit/visa)

D. Purposes of processing
Application data is processed in order to:

  • carry out and document the recruitment process,
  • organise and conduct communications and interviews,
  • assess suitability and prepare decisions,
  • enable internal coordination (including approvals),
  • ensure IT security and prevent misuse,
  • where applicable, prepare hiring (e.g., contract preparation, onboarding).

If an applicant is hired, the required data is transferred to HR systems (e.g., Personio).

E. Legal bases

  • Recruitment process: Art. 6(1)(b) GDPR (steps prior to entering into a contract); for applications in Germany additionally Section 26(1) BDSG.
  • Legal obligations (e.g., verification of the right to work, where required): Art. 6(1)(c) GDPR in conjunction with Section 4a of the German Residence Act (AufenthG).
  • Legitimate interests / legal defence: Art. 6(1)(f) GDPR, in particular to defend potential claims arising from the recruitment process. For context: the assertion of claims under the German General Equal Treatment Act (AGG) is subject to time limits (e.g., Section 15(4) AGG; Section 61b Labour Court Act (ArbGG)).
  • Talent pool (optional): Art. 6(1)(a) GDPR (consent), voluntary and withdrawable at any time with effect for the future.

F. Special categories of personal data
Special categories of personal data are generally not requested. If such data exceptionally results from documents provided or is disclosed voluntarily, it is processed only insofar as permitted by law and with additional safeguards.

G. Recipients / access
Within ib vogt, only those persons involved in the recruitment process (Talent Acquisition, HR, hiring managers, involved decision-makers) have access. Access is granted on a need-to-know basis.
For the technical processing, SmartRecruiters is used as a processor. In the event of hiring/onboarding, data may be transferred to Personio.

H. Hosting / international data transfers
Applicant data is generally processed within the EU/EEA. Where, in individual cases, transfers to countries outside the EU/EEA are necessary, appropriate safeguards are used (e.g., EU Standard Contractual Clauses and, where applicable, additional measures).

I. Retention period / deletion

  • Rejection: applicant data is generally deleted no later than 6 months after completion of the recruitment process, unless longer retention is required.
  • Hiring: required data is transferred to Personio/personnel administration; data in the applicant tracking system is deleted after transfer, where provided for.
  • Talent pool (optional): retention for 12 to 24 months (as agreed) or until consent is withdrawn.
  • Right-to-work documents: deletion in the applicant tracking system after verification or after transfer to the HR system, where required; in addition, a specific notice may be displayed in the relevant upload process (see the separate notice in the application portal).

J. Requirement to provide data
Providing application data is not legally/contractually required; however, without the necessary information, an application cannot be considered. Where verification of the right to work is legally required, the provision of appropriate evidence is necessary.

K. Data subject rights
Rights under the GDPR (access, rectification, erasure, restriction, data portability, objection). Consents may be withdrawn at any time with effect for the future. There is also a right to lodge a complaint with a supervisory authority.

L. No solely automated decision-making
No decisions are made that are based solely on automated processing and that produce legal effects concerning the applicant or similarly significantly affect the applicant (Art. 22 GDPR). Digital tools may support the recruitment process; decisions to accept or reject an application are made by employees.

M. Note on AI-supported functions (optional)
Where AI-supported functions are used in recruitment, this is done in compliance with the applicable legal requirements, including the EU Artificial Intelligence Act (AI Act).